Exploitation of Remote Services in Cyber Attacks

Adversaries are increasingly exploiting external remote services (VPNs, Citrix, RDP, SSH, exposed APIs) to gain unauthorized access, persistence, and lateral movement across sectors; attacks often leverage valid accounts obtained via credential harvesting or phishing, tools like ShadowLink for Tor hidden services, and malware/backdoors (e.g., modified Dropbear) with activity attributed to APT groups (APT28, APT29, APT41, FIN13). The report highlights incidents including the 2025 Poland Wiper attacks, warns of broad impact to energy, government, finance, and critical infrastructure, and recommends enforcing MFA, disabling unnecessary remote services, monitoring unusual remote logins and Tor connections, and auditing credentials.